Address Space Allocation Approaches in Large Orgs · Konnektivität unter Umständen instabiler...
37
www.ernw.de Address Space Allocation Approaches in Large Orgs Enno Rey, [email protected] @Enno_Insinuator
Transcript of Address Space Allocation Approaches in Large Orgs · Konnektivität unter Umständen instabiler...
www.ernw.de
Address Space Allocation Approaches in Large OrgsEnno Rey, [email protected]
@Enno_Insinuator
www.ernw.de
Who Am I ¬ Old-school network guy with some background in carrier operations.
¬ Taking care of LIR administration at some enterprise LIRs Including the one with probably the coolest org
handle: ORG-HACK1-RIPE.
¬ Involved with IPv6 since 1999 and regularly blogging about it at www.insinuator.net.
¬
¬ Host of annual Troopers IPv6 Security Summit.
6/14/2015 #2
www.ernw.de
Agenda¬ Approaches
¬ Becoming member and applying for an allocation at various RIRs
¬ Policies & Outlook
6/14/2015 #3
www.ernw.de
How to Get Global IPv6 Addresses for $ORG ¬ Use address space assigned from (one
of) your provider(s) Induces dependency, to be avoided.
¬ Apply for PI assignment from RIPE, through sponsoring LIR At RIPE usually a /48 out of 2001:678::/29.
¬ (Become member &) Apply for PA allocation from RIPE Usually a /29 out of 2a00::/12.
6/14/2015 #4
Approaches
www.ernw.de
Observations ¬ When it comes to IPv6 address space, the vast majority of (not only) large organizations decide to become a RIPE member ( LIR), as This is much easier than going for PI space through a
sponsoring LIR. It might be much cheaper as well
Even if it wasn't the overall cost of RIR membership does not really count in $LARGE_IPv6_PROJECTs.
Provides much more flexibility. Bad experience from the past re: address space.
¬ Note: I don't have the impression that RIRs are particularly unhappy about this. Let's be honest here: having more members increases
importance of any organization, right?
6/14/2015 #5
www.ernw.de
PI Space – Why Not“vielen Dank für Ihren Auftrag zur Beantragung eines /48 Provider Independent (PI) IPv6-Adressraums beim RIPE NCC. Zunächst einige Informationen zur gewünschten Beantragung. [...]
Wir weisen ausdrücklich darauf hin, dass die internationale Konnektivität unter Umständen instabiler sein kann als die eines PA-Blocks der Deutschen Telekom.Das hängt damit zusammen, dass nicht nur IP-Adressraum knapp ist, sondern auch die globale Routingtabelle (von der alle “border gateways“ weltweit eine Kopie halten müssen) bereits eine kritische Grösse erreicht hat. Daher gibt es Provider, die strikte prefix-length Filterung in ihrer Routing-Policy einsetzen. Als Folge hiervon kann es sein, das Ihr Netz von diesen Providern aus nicht erreichbar ist.“
“Die Gebühren für die Beantragung betragen ca. 1600 EUR“
6/14/2015 #6
www.ernw.de
Back to the Observations¬ As I said, most organizations we
know have become (or been before) LIR @RIPE.
¬ This makes sense and can be done with manageable effort.
¬ But...
6/14/2015 #7
www.ernw.de
Additional Issues/ Questions Might Occur
¬ Strict filtering problem
¬ Out of region use
6/14/2015 #8
www.ernw.de
The Strict Filtering Issue ¬ An organization might want to split the address space received into smaller parts to be "handled individually", on the routing level For network topology reasons
"regional network hubs/data centers"
For organizational reasons different administrative domains
For security reasons "selective announcements", e.g. DMZ-only See also http://www.insinuator.net/2014/12/security-
implications-of-using-ipv6-guas-only/
¬ Other organizations ("traditional ISPs") might not like this, for a variety of reasons. They then perform strict filtering.
6/14/2015 #9
www.ernw.de
Is this really a Problem? ¬ Well, some providers (still) do this.
¬ Overall routing table statistics seem to suggest they become fewer in numbers.
"The market will fix it".
¬ But keep this topic in mind, and consider including it in carrier selection process.
6/14/2015 #10
www.ernw.de
Strict Filtering
6/14/2015 #11
Some Numbers
See also:
https://www.troopers.de/media/filer_public/8a/6c/8a6c1e42-f486-46d7-8161-9cfef4101ecc/tr15_ipv6secsummit_langner_rey_schaetzle_slash48_considered_harmful_update.pdf
www.ernw.de
Evaluate CarriersSample
See also: http://docwiki.cisco.com/wiki/What_To_Ask_F
rom_Your_Service_Provider_About_IPv6
6/14/2015 #12
www.ernw.de
Potential Issues (II) ¬ “What can we reasonably expect on the Internet routing level when it comes to using this address space for subsidiaries/parts of our network outside of Europe and potentially announcing prefixes from local break-outs or regional hubs?”
¬ "(When) Does it make sense to apply for an IPv6 address space allocation at/from other Regional Internet Registries (RIRs)? All of them or 'the main ones'?“
¬ "If we opt for following the path of applying for allocations from several RIRs, what are the specifics/prerequisites/pitfalls of these procedures at the individual RIRs?What about initial/recurring effort & costs?"
Out of region use
6/14/2015 #13
www.ernw.de
RIRs scope
6/14/2015 #14
www.ernw.de
The Crucial Question:
"Will It Be Routed?“
6/14/2015 #15
www.ernw.de
As so oftenthe Answer Is...
¬ It depends.
OR
¬ Who knows?
6/14/2015 #16
www.ernw.de
Guidance¬ What's the official position
of the RIRs? A: there's not too much.
¬ What happens out there? A: Not much.
Even if we had more numbers – we still don't have crystal ball.
6/14/2015 #17
www.ernw.de
Out of Region Use¬ ARIN
Policy proposal ARIN-2014-1, abandoned by Advisory Council some weeks ago.
¬ RIPE NCC No policy, but some statements here+there.
¬ APNIC I'm not aware of anything.
¬ LACNIC I'm not aware of anything.
¬ AFRINIC Policy proposal heavily inspired by ARIN proposal
Position of RIRs (mainly in context of IPv4/address space poaching)
6/14/2015 #18
www.ernw.de
Out of Region Use "ARIN registered resources may be used outside the ARIN service region. Out of region use of IPv4, IPv6, or ASNs are valid justification for additional number resources if the applicant is currently using at least the equivalent of a /22 of IPv4, /44 of IPv6, or 1 ASN within the ARIN service region, respectively."
https://www.arin.net/policy/proposals/2014_1.html
Main element of ARIN policy proposal
6/14/2015 #19
www.ernw.de
Out of Region Use "RIPE NCC membership is open without conditions to everyone. However in order to receive Internet number resources the member must have a need in the RIPE NCC service region: the network that will be using the resources must have an active element located in the region.
The RIPE NCC has more than 200 member organisations which are not incorporated in the RIPE NCC services region, but do need resources for use within the region, as confirmed during their membership application process."
Andrea Cima to [arin-ppml] on 14 Apr 2015.
Main statement from RIPE's side
6/14/2015 #20
www.ernw.de
Out of Region Use ¬ When asking some friends from ISP space, it turns out they don't see much out of region announcements, as of today.
¬ In their guides/sessions Cisco claims to use one ARIN-assigned IPv6 prefix (2001:420::/32) only for their whole global network. Still this doesn't tell much about where
they (AS 109) announce it.
Reality out there.
6/14/2015 #21
www.ernw.de
Out of Region Use ¬ Some organizations might be required/temptedto do this.
¬ It's not yet clear if this is going to be "allowed"by RIR policies. I expect it will.
¬ It's not yet clear if it will work on a technical (routing propagation) level. In particular when combined with deaggregation, one might
keep the "strict filtering" craziness in mind.
¬ Most people don't like uncertainty, right? Which is one of the main drivers why enterprise
organizations follow the route of...
Quick Interim Summary
6/14/2015 #22
www.ernw.de
RIR Membership ¬ Become member/LIR at one RIR (usually RIPE), plan for consistent internal addressing scheme based on one global prefix and, maybe, perform out of region announcementsone day. "The market will solve it“
¬ Become member/LIR at several RIRs (usually RIPE, ARIN, APNIC), plan for internal addressing scheme with multiple global prefixes and, maybe, announce "regional" more-specifics from those prefixes one day. Most very large organizations we know have
followed this route.
Main variants from Enterprise LIR perspective and taking the above (issues|uncertainty) into account
6/14/2015 #23
www.ernw.de
Multiple RIR ApproachSome things to keep in mind
6/14/2015 #24
www.ernw.de
Membership at RIRs¬ Identify “suitable subsidiary in
$REGION“, incl. Point of contact who has rough under-
standing why this stuff is happening.
Certificate of registration
Person with signing authority
Be prepared to explain role & function of RIRs (or what IPv6 is) to them.
¬ Payment!
Your home work
6/14/2015 #25
www.ernw.de
Payment of RIR Fees ¬ There‘s a one-time fee and there‘s yearly membership fees.
¬ The invoice will be issued (but not necessarily sent) to $ORG_IN_REGION. Evidently so, as they are the members.
¬ Someone has to pay it (usually within some time frame...) Try to centralize this, with functional mail
addresses. Doing so can be very helpful in dis-cussions with $CEO_OF_REGIONAL_ORG, too.
This one deserves a dedicated slide
6/14/2015 #26
www.ernw.de
Payment of RIR Fees¬ Corporate Purchasing (in Budapest,
Manila etc.) will contact you:
“We don‘t have a quote from $RIR, so we can‘t act on this.“
“$RIR has to undergo vendor screening, sign up in our supplier portal etc.“
“What‘s that weird IPv6 or RIR stuff anyway?“
What could possibly go wrong? (I)
6/14/2015 #27
www.ernw.de
Payment of RIR Fees ¬ If you process payment through some 3rd party (in Budapest, Manila etc.), be prepared to...
Provide proof to $RIR that this payment relates to your application the application of $ORG_IN_REGION.
Keep the regional guys in the (cc:) loop.
¬ Did I already mention there‘s a limited time frame within the procedure?
¬ Just in case you missed that: there‘s a yearly renewal fee, too ;-)
What could possibly go wrong? (II)
6/14/2015 #28
www.ernw.de
Multiple RIR Approach ¬ APNIC Very easy to deal with. "Kickstart IPv6" program.
¬ ARIN Easy to deal with, but some cumbersome
formalities. Can be paid by credit card. Cool!
¬ LACNIC Beware: MX und BR have own registries, so LACNIC
does not "accept applications from there". Address space from those can only be used in country.
A bit antique as for their procedures (think RIPE ten yrs ago), but very nice, helpful people.
Some notes as for specific RIRs.
6/14/2015 #29
www.ernw.de
More Notes on Policies ¬ Currently there are two policy proposals of interest for the audience discussed in the RIPE Address Policy Working Group: Proposal 2015-02 "Keep IPv6 PI When
Requesting IPv6 Allocation" Proposal 2015-03 "Assessment Criteria for
IPv6 Initial Allocation Size"
¬ Please direct any specific questions, in particular as for their respective prospect to Gert ;-).
6/14/2015 #30
www.ernw.de
Proposal 2015-02¬ Main (proposed) change is removal
of the following from RIPE-641:
"If an organisation already received a PI assignment before becoming an LIR, the PI assignment should be returned upon receiving an IPv6 allocation if there are no specific routing requirements to justify both."
6/14/2015 #31
Keep IPv6 PI When Requesting IPv6 Allocation
www.ernw.de
Proposal 2015-03¬ Main (proposed) change is removal of
the following from RIPE-641, section 5.1.2 (Initial allocation size):"If so, the allocation size will be based on the number of existing users and the extent of the organisation's infrastructure."
This would allow different criteria (than users/infrastructure) to be considered as qualifiers for initial allocation greater > 29.
6/14/2015 #32
Assessment Criteria for IPv6 Initial Allocation Size
www.ernw.de
What Could Additional Criteria Look Like?
6/14/2015 #33
https://www.ripe.net/ripe/mail/archives/address-policy-wg/2015-May/010002.html
¬ John Collins from BIT suggested: Hierarchical and geographic
structuring
Segmentation of infrastructure for security
See e.g. https://www.ripe.net/ripe/mail/archives/
address-policy-wg/2015-May/009933.html
Planned longevity of allocation
www.ernw.de
Conclusions ¬ For large organizations there are different approaches as for getting global address space.
¬ Becoming LIR is considered the one providing the highest degree of flexibility.
¬ Some aspects have to be kept in mind, but the overall exercise should be done as early as possible.
¬ Do you want to be an innovator or a laggard?
6/14/2015 #34
www.ernw.de
There’s never enough time…
THANK YOU… ...for yours!
6/14/2015 #35
www.ernw.de
March, 14-18 2016Heidelberg, GermanyMake the world a safer place.
MORE INFO, EXTENSIVE ARCHIVE & REGISTRATION @ WWW.TROOPERS.DE
Guys, we would love to see you in Heidelberg!
FOLLOW THE NEWS@WEareTROOPERS
6/14/2015 #36
www.ernw.de
Questions?
¬ You can reach us at: [email protected], www.ernw.de
[email protected], www.ernw.de
¬ Our blog: www.insinuator.net
¬ Follow me at: @Enno_Insinuator
6/14/2015 #37
